CVE-2022-1190

Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc...

CVE-2022-1175

Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes...

CVE-2022-1175

GitLab CE/EE is affected by CVE-2022-1175 due to improper neutralization of user input in notes, enabling Stored XSS. Affected ranges are GitLab CE/EE versions: 14.4 up to before 14.7.7, 14.8 up to before 14.8.5, and 14.9 up to before 14.9.2. Connected documents indicate fixes exist in later rele...

CVE-2022-1190

Removed by vendor...

CVE-2022-1175

Removed by vendor...

CVE-2022-1190

Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc...

CVE-2022-1162

A hardcoded password was set for accounts registered using an OmniAuth provider e.g. OAuth, LDAP, SAML in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowing attackers to potentially take over accounts...

CVE-2022-1162

Removed by vendor...

CVE-2022-1162

GitLab CVE-2022-1162 affects GitLab CE/EE versions 14.7 before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. Root cause: a hardcoded password was set for accounts registered via OmniAuth providers (OAuth, LDAP, SAML), enabling potential account takeover. Impact: high-risk credential exposur...

CVE-2022-1121

A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption...

CVE-2022-1185

CVE-2022-1185 describes a denial-of-service in GitLab CE/EE when rendering RDoc files. Affected versions: GitLab Community Edition/Enterprise Edition 10.x; 14.7.7 and earlier in the 14.7 line; 14.8.0 to 14.8.5; and 14.9.0 to 14.9.2. The vulnerability allows an attacker to crash the GitLab web app...

CVE-2022-1185

A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration...

CVE-2022-1120

CVE-2022-1120 affects GitLab CE/EE; missing filtering in an error message allows exposure of sensitive information when an include directive in CI/CD configuration fails. Affected versions: all before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. The available connected documents reiterate ...

CVE-2022-1174

GitLab CE/EE is affected by CVE-2022-1174: a DoS condition where a crafted input in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc. can trigger high CPU usage. Affected versions: 13.7 before 14.7.7; 14.8 before 14.8.5; 14.9 before 14.9.2. Remediation: upgrade to fixed releases (14....

CVE-2022-1174

A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests,...

CVE-2022-1174

Removed by vendor...

CVE-2022-1188

CVE-2022-1188 affects GitLab CE/EE versions 12.1–before 14.7.7, 14.8.x before 14.8.5, and 14.9.x before 14.9.2, enabling a blind SSRF via the repository mirroring feature. The description notes a blind SSRF attack as the root cause, but the connected documents do not provide concrete technical de...

CVE-2022-1105

Summary of CVE-2022-1105 (GitLab) : An improper access control vulnerability affects GitLab CE/EE, allowing an unauthorized user to access pipeline analytics even when public pipelines are disabled. Affected versions are 13.11 through before 14.7.7, 14.8 before 14.8.5, and 14.9 before 14.9.2. The...